Skip to content

Commit daa6e72

Browse files
pooknullhors
pooknull
and
hors
authored
K8SPSMDB-1101: fix usage of custom tls certificate (#1566)
* K8SPSMDB-1101: fix usage of custom tls certificate https://perconadev.atlassian.net/browse/K8SPSMDB-1101 * proper fix * add test to csv * fix having only one custom internal secret --------- Co-authored-by: Viacheslav Sarzhan <[email protected]>
1 parent 1655059 commit daa6e72

18 files changed

+1441
-15
lines changed

‎e2e-tests/custom-tls/compare/secret_some-name-ssl-internal.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
annotations:
5+
my-custom-annotation: "true"
6+
name: some-name-ssl-internal
7+
type: kubernetes.io/tls

‎e2e-tests/custom-tls/compare/secret_some-name-ssl.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
annotations:
5+
my-custom-annotation: "true"
6+
name: some-name-ssl
7+
type: kubernetes.io/tls

‎e2e-tests/custom-tls/compare/statefulset_some-name-cfg-oc.yml

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
annotations: {}
5+
generation: 1
6+
labels:
7+
app.kubernetes.io/component: cfg
8+
app.kubernetes.io/instance: some-name
9+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
10+
app.kubernetes.io/name: percona-server-mongodb
11+
app.kubernetes.io/part-of: percona-server-mongodb
12+
app.kubernetes.io/replset: cfg
13+
name: some-name-cfg
14+
ownerReferences:
15+
- controller: true
16+
kind: PerconaServerMongoDB
17+
name: some-name
18+
spec:
19+
podManagementPolicy: OrderedReady
20+
replicas: 3
21+
revisionHistoryLimit: 10
22+
selector:
23+
matchLabels:
24+
app.kubernetes.io/component: cfg
25+
app.kubernetes.io/instance: some-name
26+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
27+
app.kubernetes.io/name: percona-server-mongodb
28+
app.kubernetes.io/part-of: percona-server-mongodb
29+
app.kubernetes.io/replset: cfg
30+
serviceName: some-name-cfg
31+
template:
32+
metadata:
33+
annotations: {}
34+
labels:
35+
app.kubernetes.io/component: cfg
36+
app.kubernetes.io/instance: some-name
37+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
38+
app.kubernetes.io/name: percona-server-mongodb
39+
app.kubernetes.io/part-of: percona-server-mongodb
40+
app.kubernetes.io/replset: cfg
41+
spec:
42+
affinity:
43+
podAntiAffinity:
44+
requiredDuringSchedulingIgnoredDuringExecution:
45+
- labelSelector:
46+
matchLabels:
47+
app.kubernetes.io/component: cfg
48+
app.kubernetes.io/instance: some-name
49+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
50+
app.kubernetes.io/name: percona-server-mongodb
51+
app.kubernetes.io/part-of: percona-server-mongodb
52+
app.kubernetes.io/replset: cfg
53+
topologyKey: kubernetes.io/hostname
54+
containers:
55+
- args:
56+
- --bind_ip_all
57+
- --auth
58+
- --dbpath=/data/db
59+
- --port=27017
60+
- --replSet=cfg
61+
- --storageEngine=wiredTiger
62+
- --relaxPermChecks
63+
- --sslAllowInvalidCertificates
64+
- --clusterAuthMode=x509
65+
- --tlsMode=preferTLS
66+
- --configsvr
67+
- --enableEncryption
68+
- --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
69+
- --wiredTigerIndexPrefixCompression=true
70+
- --quiet
71+
command:
72+
- /opt/percona/ps-entry.sh
73+
env:
74+
- name: SERVICE_NAME
75+
value: some-name
76+
- name: MONGODB_PORT
77+
value: "27017"
78+
- name: MONGODB_REPLSET
79+
value: cfg
80+
envFrom:
81+
- secretRef:
82+
name: internal-some-name-users
83+
optional: false
84+
imagePullPolicy: Always
85+
livenessProbe:
86+
exec:
87+
command:
88+
- /opt/percona/mongodb-healthcheck
89+
- k8s
90+
- liveness
91+
- --ssl
92+
- --sslInsecure
93+
- --sslCAFile
94+
- /etc/mongodb-ssl/ca.crt
95+
- --sslPEMKeyFile
96+
- /tmp/tls.pem
97+
- --startupDelaySeconds
98+
- "7200"
99+
failureThreshold: 4
100+
initialDelaySeconds: 60
101+
periodSeconds: 30
102+
successThreshold: 1
103+
timeoutSeconds: 10
104+
name: mongod
105+
ports:
106+
- containerPort: 27017
107+
name: mongodb
108+
protocol: TCP
109+
readinessProbe:
110+
exec:
111+
command:
112+
- /opt/percona/mongodb-healthcheck
113+
- k8s
114+
- readiness
115+
- --component
116+
- mongod
117+
failureThreshold: 3
118+
initialDelaySeconds: 10
119+
periodSeconds: 3
120+
successThreshold: 1
121+
timeoutSeconds: 2
122+
resources: {}
123+
securityContext:
124+
runAsNonRoot: true
125+
terminationMessagePath: /dev/termination-log
126+
terminationMessagePolicy: File
127+
volumeMounts:
128+
- mountPath: /data/db
129+
name: mongod-data
130+
- mountPath: /etc/mongodb-secrets
131+
name: some-name-mongodb-keyfile
132+
readOnly: true
133+
- mountPath: /etc/mongodb-ssl
134+
name: ssl
135+
readOnly: true
136+
- mountPath: /etc/mongodb-ssl-internal
137+
name: ssl-internal
138+
readOnly: true
139+
- mountPath: /opt/percona
140+
name: bin
141+
- mountPath: /etc/mongodb-encryption
142+
name: some-name-mongodb-encryption-key
143+
readOnly: true
144+
- mountPath: /etc/users-secret
145+
name: users-secret-file
146+
workingDir: /data/db
147+
dnsPolicy: ClusterFirst
148+
initContainers:
149+
- command:
150+
- /init-entrypoint.sh
151+
imagePullPolicy: Always
152+
name: mongo-init
153+
resources: {}
154+
terminationMessagePath: /dev/termination-log
155+
terminationMessagePolicy: File
156+
volumeMounts:
157+
- mountPath: /data/db
158+
name: mongod-data
159+
- mountPath: /opt/percona
160+
name: bin
161+
restartPolicy: Always
162+
schedulerName: default-scheduler
163+
securityContext: {}
164+
serviceAccount: default
165+
serviceAccountName: default
166+
terminationGracePeriodSeconds: 60
167+
volumes:
168+
- name: some-name-mongodb-keyfile
169+
secret:
170+
defaultMode: 288
171+
optional: false
172+
secretName: some-name-mongodb-keyfile
173+
- emptyDir: {}
174+
name: bin
175+
- name: some-name-mongodb-encryption-key
176+
secret:
177+
defaultMode: 288
178+
optional: false
179+
secretName: some-name-mongodb-encryption-key
180+
- name: ssl
181+
secret:
182+
defaultMode: 288
183+
optional: false
184+
secretName: some-name-ssl
185+
- name: ssl-internal
186+
secret:
187+
defaultMode: 288
188+
optional: true
189+
secretName: some-name-ssl-internal
190+
- name: users-secret-file
191+
secret:
192+
defaultMode: 420
193+
secretName: internal-some-name-users
194+
updateStrategy:
195+
type: OnDelete
196+
volumeClaimTemplates:
197+
- metadata:
198+
name: mongod-data
199+
spec:
200+
accessModes:
201+
- ReadWriteOnce
202+
resources:
203+
requests:
204+
storage: 3Gi
205+
status:
206+
phase: Pending

0 commit comments

Comments
 (0)